Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What are the Path Length and Path Depth constraints for?
Short answer
Both are structural checks that put a limit on the form of the path, and they are defined only in glob rules and in Any Paths. Path Length measures the length of the path excluding the query string and with the trailing / removed; Path Depth measures the number of / in the path (3 for /a/b/c). As the operator, No Restriction, Less Than or Equal To, Equals To, Greater Than or Equal To or Range is selected. A request that exceeds the restriction gets 24 points as a Path length or Path depth violation in the Structure Limits category; it is blocked by this violation alone in Blocking mode, recorded in Monitor mode and not inspected in Learning mode. The default of Any paths is a length of 1–8192 and a depth of at most 256; a new glob rule starts with No Restriction. These fields are not in the form of an exact rule, and the restrictions are not inherited from Any paths; only an exact rule that comes with Import (OpenAPI) copies the default limits of Any paths, and an exact rule opened by learning copies the Path depth value of Any paths, when it is created, and the rule applies them until it is saved from the form. The check and the form fields work while the Structure Checks switch is on.
How Does It Work?
| Path length | Path depth | |
|---|---|---|
| What it measures | The length of the path (excluding the query string, with the trailing / removed) | The number of / in the path: / → 1, /a/b/c → 3 |
| Operators | No Restriction · Less Than or Equal To · Equals To · Greater Than or Equal To · Range (both ends included) | Same |
| Any paths default | Range 1–8192 | Less Than or Equal To 256 |
| New glob rule | No Restriction | No Restriction |
| Exact rule | Not in the form; no check is done in a rule added with Add (a rule that comes with Import (OpenAPI) carries the 1–8192 value) | Not in the form; no check is done in a rule added with Add (a rule that comes with Import (OpenAPI) carries the value of at most 256, and a rule opened by learning carries the value Any paths has at that moment) |
| Violation | Path length, Structure Limits, 24 points | Path depth, Structure Limits, 24 points |
- 24 points reach the blocking threshold at every OWASP Protection Level; therefore, a single violation blocks the request in Blocking mode.
- The restriction is not inherited: the matching rule's own value is applied. If an exact rule matches, the value in the exact rule's own record (none in a rule added with Add) is applied; if glob rules match, the value of the first matching glob rule is valid (If a request matches more than one page type, how are the rules applied (exact path priority, glob rules merged with Any Paths)?).
- While Structure Checks is off, the two fields are not shown in the Add and Edit forms and no check is done; Allowed Methods is not affected by this switch.
- The value is set on the Page types → rule → Edit path by selecting the operator, entering the value and saving with the Edit button of the form (editing the Any paths rule). In WEB-CLI, the
waf fw-rules update poolId <vService> hostGroupId <group> id <rule> --pathSize.op "<=" --pathSize.val 128command is used; for the depth,--pathDepth.op/--pathDepth.valis written in the same way (path restrictions). - In Merge, the range that covers the limits of both rules is taken; the side that has no restriction (No Restriction) is not taken into account (How are settings (methods, OWASP) combined during a Merge?).
- An Any paths set up with the default template at the Aggressive level comes with narrower limits (a length of 1–1024, a depth of at most 8) (How do I reset the rules to the default settings?).
What Is It For?
| Without a restriction | With a restriction |
|---|---|
| Scanning and overflow attempts made with excessively long paths reach the application | A path that exceeds the limit produces a violation; in Blocking mode, the request is not forwarded to the application |
Very deep paths (/a/b/c/…) can be used for directory scanning | The depth is limited to the real structure of the application |
The tightening is first watched in Monitor mode; after it is verified that legitimate paths do not produce violations, Blocking is switched to.
Common Misconceptions
- "The 8192 limit of Any paths is applied to all paths." The restriction is not inherited; a path that has its own rule gets that rule's own value, and in an exact rule added with Add, it is not applied at all.
- "The depth is the number of segments." The depth is the number of
/; it is 3 for/a/b/cand 1 for the root/. - "While Structure checks is off, the fields have been left empty." The saved values are kept; when the switch is turned on, they appear in the form again and are applied.
How it is done in the documentation
